Topic starter
14/09/2026 10:09 am
TL;DR: Spreadsheet-based access reviews in manufacturing create the appearance of compliance while stripping out SoD conflict context, lifecycle events, and remediation evidence, according to OpenIAM. The deeper problem is that review cadence, not role names alone, determines whether access governance can actually catch inappropriate entitlements.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why Spreadsheet Access Reviews Fail Manufacturing Teams”.
Key questions
Q: What breaks when access reviews are run as spreadsheets in manufacturing?
A: The review loses the identity context needed to make a meaningful decision.
Q: Why do spreadsheet access reviews create compliance risk even when managers sign them?
A: Because a signature only proves that a list was checked.
Q: How should manufacturing teams know whether access review controls are working?
A: Look for a review process that exposes conflict context, reacts to lifecycle events, and produces timestamped revocation evidence.
Practitioner guidance
- Replace spreadsheet reviews with governed review workflows Present entitlement data with business context, SoD conflict indicators, lifecycle state, and an auditable decision trail so reviewers can assess actual risk rather than role labels.
- Trigger reviews from lifecycle events Fire review campaigns from plant transfers, role changes, terminations, and contractor expirations so access is reassessed when risk changes, not only on a fixed schedule.
- Map role combinations before review distribution Identify access combinations across SAP, directory services, and plant applications that create SoD conflicts, then surface those conflicts to reviewers before approval.
Bottom line: Spreadsheet access reviews fail because they strip out the identity context that makes access decisions meaningful.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Spreadsheet access reviews create an evidence illusion, not an access governance control. The core failure is that the artefact records a review event while stripping away the context that determines whether the decision was valid. In manufacturing, that context includes SoD conflicts, plant transfers, contractor expiry, and privilege elevation across systems. Practitioners should treat the spreadsheet as an administrative extract, not as a governance mechanism.
A few things that frame the scale:
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: What is the difference between a reviewed spreadsheet and a governed access review?
A: A reviewed spreadsheet is a static artefact that shows a list was circulated and marked up. A governed access review presents the full user profile, captures risk-informed decisions in workflow, ties revocations to completion, and retains exportable evidence for audit and remediation.
👉 Read our full editorial: Spreadsheet access reviews fail when identity context is stripped